CVE-2026-108812: Improper Authorization in SEMCMS

This vulnerability in SEMCMS up to version 5.0 affects an unknown function in the /admin/SEMCMS_User.php?Class=Deleted&CF=user file, resulting in improper authorization. The vulnerability can be exploited remotely without privileges or user interaction, allowing attackers to perform unauthorized actions. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited impact on confidentiality and availability. The vendor was contacted but has not provided a response or patch. Public exploit code is available.

Attackers can remotely exploit this vulnerability to bypass authorization controls in SEMCMS 5.0, potentially gaining unauthorized access or performing unauthorized actions within the affected component. The impact is limited to partial confidentiality and availability loss, with no integrity or system compromise explicitly stated.

No official patch or vendor advisory is available at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, organizations should consider restricting access to the affected administrative interface and monitor for exploitation attempts.